[dependabot]

Summary

Upgrade @nextcloud/viewer from 2.0.0-beta.20 to 2.0.0-beta.21 and remove the temporary Dialogs 7 isolation introduced by #9301. The updated Viewer and its Image Editor now both declare peer compatibility with @nextcloud/dialogs 8.

Cleanup of TODO(viewer-compat)

• Move the native Viewer into the root application manifest and lockfile, using the existing root Dialogs 8 dependency.
• Delete the private src/viewer/ bridge, its installation boundary, and the root postinstall command.
• Restore direct @nextcloud/viewer imports and update the focused Viewer mocks.
• Remove obsolete Viewer-only CI compatibility guard, Dependabot directory and REUSE exceptions.
• Remove the temporary Vue deduplication in Vite and Vitest: the root dependency tree now has a single Vue and @nextcloud/vue installation. Focused Viewer/Dialogs regression tests, TypeScript, lint, and production build passed with the dedupe entries removed.

Preserve behavior and security

Do not replace LibreSign's existing getViewer()/getHandlers()/canView() behavior or its signed-PDF UUID safeguards. The native PDF handler must not receive the original owner's nodeId, even for an authenticated viewer; the existing regression cases test this boundary.

Keep the permanent Dialogs 8 notification/file-picker regression tests. Upstream nextcloud/files_pdfviewer still registers files_pdfviewer-main.css through LoadViewerListener, although Vite emits its styles as CSS chunks. The Playwright-only empty-file fixture therefore remains temporarily; commit e1f43d2a replaces its passive TODO with a fail-on-upstream-change CI guard. CI now fails explicitly when the CSS file appears or the PHP registration changes, requiring re-validation and removal/update of the fixture.

CI evidence before cleanup

• On Dependabot HEAD dca55c8, Build Javascript built successfully but then deliberately failed the compatibility guard introduced in chore(deps): adopt dialogs 8 with isolated native viewer #9301 with Viewer cleanup available. The strict peer dependency probe completed successfully.
• Before this cleanup, Playwright ran 88 scenarios: 87 passed; footer-policy-hierarchy-ui.spec.ts timed out in a policy selector. That failure is outside the native Viewer paths; attribution remains unproven.
• The source-only cleanup is in signed DCO commit f43a7ded. The complete CI for that head must be checked before declaring merge readiness.

Review checklist

• Remove the now-obsolete Dialogs 7 Viewer integration boundary.
• Preserve and update native Viewer safety tests.
• Remove only the temporary viewer-compat controls whose prerequisite is met.
• Verified isolated root npm ci, direct dependency tree, TypeScript, lint (0 errors, 23 warnings) and production build locally.
• The 15 focused Viewer tests and 4 Dialogs 8 integration tests passed locally before and after deduplication cleanup.
• Confirm the native PDF Viewer/UUID safeguards in a real Nextcloud Playwright integration run.
• Evaluate any remaining failing workflow from its earliest causal error.

Related: #9301; #9104. No merge is requested as part of this preparation.

Follow-up cleanup validation

Commit 7f98048d removes the temporary Vue deduplication lines from vite.config.mjs and vitest.config.js, restoring their pre-#9301 configuration. This was verified against the original #9301 patch. An isolated npm installation (Node 24/npm 11) has one Vue 3.5.45 and one @nextcloud/vue 9.14.1; focused tests passed (19/19), npm run ts:check passed, ESLint passed with 0 errors and 23 warnings, and npm run build succeeded. The empty CSS fixture in .github/workflows/playwright.yml is still required by the current upstream files_pdfviewer source. This was subsequently converted into an actionable CI guard in signed DCO commit e1f43d2a, with four synthetic cases verified locally: current broken upstream stays supported; upstream CSS appearing, removal of the registration, or both changes trigger a CI error instructing cleanup. The actual upstream repair belongs in nextcloud/files_pdfviewer (review/removal of its stale Util::addStyle call and browser verification). The complete CI for HEAD e1f43d2a remains the final merge gate.

[github-actions]

Code Metrics Report

Note: Metrics describe the revision analyzed by the successful PHPUnit run. Newer commits with pending, canceled or failed checks may not yet be represented in this report.

	main (676d88e)	#9461 (37d64f3)	+/-
Coverage	76.2%	76.2%	0.0%
Test Execution Time	3m46s	3m51s	+5s

Details

  |                     | main (676d88e) | #9461 (37d64f3) | +/-  |
  |---------------------|----------------|-----------------|------|
  | Coverage            |          76.2% |           76.2% | 0.0% |
  |   Files             |            500 |             500 |    0 |
  |   Lines             |          28581 |           28581 |    0 |
  |   Covered           |          21784 |           21784 |    0 |
- | Test Execution Time |          3m46s |           3m51s |  +5s |

---

Reported by octocov